GHSA-rvjg-gxwx-j5gf

ghsaUSosv

OIDC Logout redirect in keycloak

view advisory published 2022-04-28Licence: CC-BY-4.0

A flaw was found in keycloak. The OIDC logout endpoint does not have CSRF protection. The highest threat from this vulnerability is to system availability.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-10734US	low3.3	0.21% (11th)	—	2021-02-11
A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Re…

references

External citations — patches, advisories, analysis.

https://bugzilla.redhat.com/show_bug.cgi?id=1831662WEB
https://github.com/keycloak/keycloakPACKAGE
https://github.com/keycloak/keycloak/security/advisories/GHSA-rvjg-gxwx-j5gfWEB
https://issues.redhat.com/browse/KEYCLOAK-13653WEB
https://nvd.nist.gov/vuln/detail/CVE-2020-10734ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan